BeyondInsight / Password Safe

I’m looking for a best practices and BeyondTrust recommendations for Secrets Safe. Following is a question asked by one of my customers.  Any thoughts, please feel free to advise. Do you have a “best practice” recommendation on setting up team folders within Secrets Safe?  With our current solution it was recommended that those types of permissions only be granted via local groups to prevent possible escalation of privileges since local group membership would be managed by Password Safe admins, where Directory groups from Azure or AD could be managed by persons who shouldn’t necessarily have rights to manage such access.

Hi ,  Is there a way to rotate password in password safe  based on certain systems or application access. i have bunch of users who access some sensitive app access and some general infra, if user access those sensitive system password rotate more frequently than other systems. Regards,Maulik

Hi, Is there a way to create Discovery Scan Account  over the API like Functional Account in Password Safe ? RegardsArno

The following articles were published last week. New Knowledge Base Articles: KB0022293 - Unable to edit secret in Secret Safe created by a user who does not have permissions anymore KB0022305 - BTUpdater service keeps crashing after update to 3.4.2.1876 KB0022308 - What causes a High Availability active passive appliance to failover?

The following articles were published last week. New Knowledge Base Articles: KB0022248 - What are the deployment requirements for Enhanced Session Auditing (ESA)? KB0022263 - Linux server scan executes init.d scripts instead of validating service existence during status check KB0022277 - How long do discovery support logs reside on the server before being purged?

Hello Team,  We have observed a issue with PasswordSafe, where Managed Account Next change date is calculated based on Last scheduled change date. If the user changes the password manually, Next change date is not updated to new date based on Password change Frequency (Xdays). The problem observed today, is that teams who have manually changed the password for a Service account ahead of a policy based 90-day rotation, as part of a RFC change window, will suddenly have the service account password rotated automatically again (potentially just a few days later) on the 90-day rotation enforcement date by PasswordSafe - thus breaking their production service. How can we achieve this use case in such a way that Next change date is updated based on last change date (scheduled & manual)?

Hello community,I’m looking for a list of requirements for ESA deployment along with information if SMB3 is supported and which SMB version is the default one?I can’t find this information anywhere in documentation, the only mention about it is this KBA but its 9 months old and I’m not sure if its up to date at this moment.Cheers,Bartosz

Hello everyone,We’re struggling with lack of possibility to introduce more granular access for PS Administrators, there’s an idea for the same More granular access rights for custom PS | All Product Ideas - Public Do you have similar experience with the product? If yes then please share your thoughts on that and like an idea if you find it useful, maybe it will get some attention thanks to that.Cheers,Bartosz 

The following articles were published last week. New Knowledge Base Articles: KB0021742 - How to configure Duo as an Identity Provider for SAML KB0022219 - Workforce Passwords continuously spins (loads) and last synchronized shows 'an error occurred' KB0022222 - Group sync fails when selecting a specific Domain Controller in PS cloud

I wanted to bring this to the community for feedback as it was brought up for discussion during a troubleshooting case for a Password Safe customer, while configuring Remote Applications to be launched via ps_automate.exeIt was found that if we expand the Remote App window during the login process, we may see the login screen display look distorted based on the size the window takes up on the user’s screen. I attached a screen capture showing what was observed while initiating the session with a single high resolution display detected and one with multiple displays detected. observed remote app loginThe important thing to note here is that this does NOT affect the look of the actual application when it appears in RemoteApp mode and it does not affect the ability to launch the application itself. Th

Hi all,I’m wondering if we’re the only ones who’s struggling with this problem, as you can find in already raised idea Additional TOTP step for federated | All Product Ideas - Public it’s not possible to use TOTP when federated authentication to Password Safe is enabled.Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful.Cheers,Bartosz 

The following articles were published last week. New Knowledge Base Articles: KB0021352 - Secrets Safe import secrets menu option missing KB0022203 - User in admin group is not able to see "view all safes" toggle in Secrets Safe KB0022204 - Cannot view discovery reports "An error was reported"

Hi All,We have AD users in password safe who are quarantined and form login disabled. The users are no longer in organizations. The group we created to onboard these users are also disabled/deleted. The access revoke method used by earlier admins were incorrect and they removed the group from password before syncing them. Is there a way we can make these users status as inactive?

Hi All,When the Password Safe Detailed Discovery Scan runs against a Windows server, the BTExecService agent deployed on the scanned server enumerates the members of all local admin groups, so these can eventually be onboarded and managed by Password Safe. We have observed that Group Memberships for each enumerated account are also checked. This enumeration process is causing the LastLogonTimeStamp for the enumerated accounts to be updated, generating logon events attributed to the Discovery Scan agent BTExecExt.Phoenix.exe, even though no actual logon operation took place.In fact, according to the Microsoft article below, the LastLogonTimeStamp attribute can be updated and trigger a logon event even if the user has not logged on. This behaviour is an artifact of a Kerberos operation known as Service-for-User-to-Self (S4u2Self), in which a client/service can request a ticket for a user that is only useful for things like determining Access Checks or Group Membership.

Hi All,Currently it's not possible to add a webbrowser application native in BeyondInsight Password Safe and inject the privileged/managed account credentials, without RDP/RDS server integration. Please add the option to: Add a (web)application page and inject the privileged/managed account credentials Add a rotate option, using an API functional account with custom API scripting/calls. Best regards,Dheeraj.

We recently upgrade to 24.3 and now we have a reporting issue.  Using the API /Secrets-Safe/Secrets with a GET returned all the secrets stored.  Now, it returns nothing.  Other API calls to other endpoints work with no problem.  This is a SOX reporting issue now.  I have opened a ticket but thought I would try here to see if anyone had any thoughts.  Other than the software upgrade, nothing else has changed. TIA

The following articles were published last week. New Knowledge Base Articles: KB0021854 - BeyondTrust Product Update Server changing from Imperva to CloudFlare KB0022146 - Not receiving reports from the Analytics and Reporting tool - No records were found matching your criteria KB0022192 - Appliance logs not downloading - timeout error "The request was canceled due t

Hello Team,We have around 500+ Managed Systems, and we want to change their functional account in bulk. Can someone please suggest best possible way to do this?Note: The functional account remains same for all. Thanks,Prasad

Hop on and join our interactive workshop, where you can gain hands-on experience and handle different use case scenarios.TITLE: Password Safe: Discovering and Adding Assets Interactive Workshop Date: 28 May 2025 Time: 8 am Eastern and 1 pm UK and 8 pm SGTDuration: 90 minutes  Workshop Aim:This interactive workshop enables participants to learn the aim and process of adding Assets into BeyondInsight. There will be an opportunity to troubleshoot and configure Discovery Scanning for different Use Cases, configure these within a virtual test environment and collaborate with other contributors. Learning Objective:Learn how to create and configure Discovery Scanning in Password Safe and apply them to specific use cases 

TITLE: Password Safe: Access Policies Interactive Workshop Date: 29 April 2025 Time: 3 am Eastern and 8 am UK and 3 pm SGTDuration: 90 minutes  Workshop Aim:This interactive workshop enables participants to learn the aim and process of configuring and scheduling Access Policies in Password Safe. There will be an opportunity to troubleshoot and configure Access Policies for different Use Cases, configure these within a virtual test environment and collaborate with other contributors. Learning Objective:Learn how to create, configure and schedule Access Policies in Password Safe and apply them to specific use cases In this session we will cover:Introduction to Access Policies Access Policy Types Configuring and Schedu

Hi all,I’m wondering if we’re the only ones who’s struggling with this problem, as you can find in already raised idea Ability to upload our private CA certificate or to be able to turn off the certificate verification in the UI. Sometimes if a CA certificate it’s not working, we need to rebuild the certificate instead of being able to only turn off the certificate verification option for SIEM integration (QRADAR) for example.Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful.Cheers,DerianV

Hello Everyone,I wanted to bring up this issue with RDP Failure error messages in PBPS. Currently, when an RDP session fails, users see a generic message like “Failed to connect RDP session” without any specific details on the reason- whether it’s an account lockout, network issue or authentication failure.Pbsm.log contains more detailed error codes, it would be great if these codes are translated into more meaningful messages within the UI, it would significantly reduce troubleshooting time.We have an idea for same raised:  More Description Error message when RDP | All Product Ideas - PublicWould love to hear if anyone else have encountered same challenges? You can share your experience or vote for an idea if you find it useful.CheersThanks and regardsJaya

Dear Team, The client has a use case to upload TOTP seed file and generate the new OTP on the console [similar to the retrieve password option]. For example, BeyondTrust Password Safe acts like Google/Microsoft authenticator app. I can't find any platform to upload the seed file, which will generate the OTP as output. Anyone who implemented such use case before? This kind of usecase is already available in BitWarden. Please find the link below:Viewing TOTP Code: https://bitwarden.com/help/integrated-authenticator/ Thanks in advance!!Varun

Hello community,I’m wondering if our company is the only one who’s experiencing issues due to limited functionality of discovery scanner in password safe? We’re facing multiple issues including problems with discovering domain accounts added to local admins, constant login event alerts triggering etc.We even raised an idea for improvement for scanner:Improved discovery scanner | All Product Ideas - PublicI would like to know if you’ve got similar experience, maybe you found some solution to make it better, also if you found this idea useful please vote for it.Cheers,Bartosz